CVE-2016-10894

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-254

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-108956.1The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.CVE-2016-108966.1The seo-redirection plugin before 4.3 for WordPress has stored XSS.CVE-2016-108976.1The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.CVE-2016-108986.1The total-security plugin before 3.4.1 for WordPress has XSS.CVE-2016-108995.3The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.CVE-2016-10907.8Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, a CVE-2016-109006.1The uji-countdown plugin before 2.0.7 for WordPress has XSS.CVE-2016-109016.1The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.CVE-2016-109028.8The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-109038.8The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-109049.8The olimometer plugin before 2.57 for WordPress has SQL injection.CVE-2016-109057.8An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and r